rule "urls"
when
    is_url("foobar") == false &&
    is_url(1234) == false &&
    is_url(12.34) == false &&
    is_url(true) == false &&
    is_url(to_url("http://example.org/")) == true &&
    urlencode("this is a test") == "this+is+a+test" &&
    urldecode("this+is+a+test") == "this is a test" &&
    urldecode("this%20is%20a%20test") == "this is a test" &&
    urldecode(urlencode("this is a test")) == "this is a test"
then
    let url = to_url("https://admin:s3cr31@some.host.with.lots.of.subdomains.com:9999/path1/path2/three?q1=something&with_spaces=hello%20graylog&equal=can=containanotherone#anchorstuff");
    set_fields({
        protocol: url.protocol,
        authority: url.authority,
        user_info: url.userInfo,
        host: url.host,
        port: url.port,
        path: url.path,
        file: url.file,
        fragment: url.fragment,
        query: url.query,
        q1: url.queryParams.q1,
        with_spaces: url.queryParams.with_spaces,
        equal: url.queryParams.equal
    });
    trigger_test();
end